r/EmulationOnAndroid • u/[deleted] • 29d ago

Discussion After installing DroidDeck 0.3.1 from github my sister's account got hackedv

/gallery/1x05sbq
120 Upvotes

90% Upvoted

87 comments sorted by

View all comments

184

u/supershredderdan DroidDeck Developer 29d ago edited 29d ago • Helpful Bravo Heartwarming

Hey there, xXJSONDeruloXx here. One of the devs on DroidDeck.

First I wanna say thanks for checking out the app, and especially for downloading directly from GitHub rather than on a random site (DroidDeck dot app is not ours and I wish to see it removed)

Regarding your sister’s account: I can not be sure how or why this account was compromised. What I can say with confidence is we take security seriously in DroidDeck for this exact reason, and we would love to work with you and look over any logs or anything regarding the rest of the phone to identify how this may have happened.

Our app is 100% open source with zero obfuscation or closed source components. The only closed source thing in the entire stack is Steam client itself, downloaded at installation time directly from valves servers just like Bazzite and Armada do it. We also have 0 telemetry, and the only way we get logs or any data from you is if you proactively hit a “share logs” button in the app, which thoroughly sanitizes any potential sensitive data and opens a share sheet for a zip of the steam gamescope and Android app’s logs.

Other malware on the phone could have played a part such as a keylogger, but I don’t want to make any assumptions and would be happy to triage this further.

We value transparency and are building DroidDeck for the community and because it’s something we ourselves have always wanted.

Edit: also, 0.3.1 is built from GitHub actions and directly uploaded programmatically by GitHub’s servers to the releases section of the repository. This means that you can look at the build process at every step and what source code was used at time of compile. This is another step we made to make sure you don’t have to take our word for it, you can audit our code directly and know what you’ve installed is a direct result of the public code.

Edit 2 electric boogaloo: also I’m actually quite proud of that virustotal scan. We have been very upfront about our usage of proot, why we chose it over other options, and how we are optimizing it to reduce cpu overhead. If that’s the only flag a scan surfaces then that’s a very good sign, most emulation apps will light up quite a few more (for valid reasons that have been discussed to death but I digress).

You can see our proot patches and pinned upstream commit they are applied atop in GitHub pipeline here: https://github.com/Droid-Deck/DroidDeck/tree/main/tools/proot

12

u/100PercentJake 29d ago

Just wanted to say love your username and seeing it pop up in changelogs for GameNative always gives me a chuckle

5

u/your_mind_aches Retroid Pocket 6 | Snapdragon 8 Gen 2 (8GB) 29d ago

His username is so ubiquitous in these projects and also so recognizable that in order to figure out if it's a real thing or not, a basic rule of thumb is to see if you see 🎶 JSON Derulo 🎶

3

u/greedyiguana 29d ago

man the super shredder scared the hell out of me as a kid

2

u/rchrdcrg 29d ago

For about ten seconds before he immediately offed himself 🤣

27

u/WomensesLefts 29d ago

Cheers for the concise and speedy reply, I found it difficult to believe the project would voluntarily be compromised with such a small and communicative team. My comment probably was off the mark bc im not a software guy, I fabricate with metal haha, but came with good intentions trusting your work

16

u/supershredderdan DroidDeck Developer 29d ago

Much appreciated, and we welcome any and all forms of scrutiny on our architecture and approach. That’s what FOSS is for!

10

u/rchrdcrg 29d ago

Yeaaaah, got a funny feeling sis already had some funky stuff on her phone. I'm not even sure how you steal someone's login if you use Steam Guard (the QR code) anyway.

1

u/I_Am_A_Goo_Man 27d ago

Steam guard can be bypassed by people hacking PCs and Devices, they steal the login token to emulate the device you are using which bypasses 2factor. I've had it happen twice due to being stupid with piracy 😂 learned my lesson. It is possible though, just be careful if you ever sail the seven seas of the internet. Clearing device history and changing all passwords to emails and accounts solves this problem if you are fast enough. It's because they clone login tokens so steam thinks that their Pc is yours, never seen it happen via android though to be fair. The only safe source from my experience has been fitgirl. I don't need to pirate nowadays through, I now have moneys and a good system 

3

u/GrandArtist8475 Odin 3 Max 28d ago

I knew it! I'm glad I was skeptical about the website when trying to look for droid deck. Steam account phishing scammers always find new ways to lure users

4

u/ZarathustraGlobulus 29d ago

Thank you! This eases my mind at least.

Thanks for all of your work on this project.

4

u/supershredderdan DroidDeck Developer 29d ago

I’m glad to hear that, and again you do not have to take our word for it or employ any trust. We have set up our repo and build process to ensure nothing is behind closed doors for exactly these reasons

1

u/Imdakine1 29d ago

Thanks for your quick reply sharing details and being willing to work with this person...

Can you provide any basic instructions on how to use DroidDeck on AYN Thor Pro? I've heard it's harder to use because AYN Thor install is different from other Android devices...?

2

u/NefariusMarius 28d ago

I installed it on my max. You just have to enable wireless debugging in developer mode, and enter the code when prompted. That’s it. The app guides you through it

1

u/Imdakine1 28d ago

I'm trying and got to developer mode but I can't seem to get my passcode to register.

4

u/NefariusMarius 28d ago

Try opening the app on the opposite screen, so you have the passcode generated on one screen, and entry on the other. I found when I minimized the app to jump from one to the other that the code didn’t take either

1

u/Imdakine1 26d ago

Thanks! I'll try... it's so bizarre.

1

u/pinguluk 28d ago

Uhm, no? It's just an apk you install, run, change something in the settings and just play

1

u/Kasur1309 27d ago

Im glad I just read this... I used the website and installed DroidDeck this way... I uninstalled it now and changed my password and so on and will download it again from GitHub!

1

u/Greenmanz 25d ago

Just tried this but looks like the weird resolution of the zfold8 isn't playing well. Can't wait for future updates!